Executive brief
Next.js is a popular React framework for building web applications. The Image Optimization feature in Next.js failed to properly isolate cached images based on request headers like cookies and authorization tokens, allowing an attacker to access cached images intended for other users. This could expose sensitive user-specific images or data to unauthorized users.
Technical details
This is a cache key confusion vulnerability (CWE-524) affecting the Image Optimization feature in Next.js. When API routes serve images that vary based on request headers (Cookie, Authorization, etc.), the caching mechanism did not properly differentiate between requests, causing images cached for one user to be served to others. The vulnerability requires the application to use API routes for image serving with image optimization enabled and for images to vary by request headers. An attacker on the same system or with network access to the cache can retrieve cached images intended for other users. The vulnerability is fixed in Next.js v14.2.31 and v15.4.5.
Affected products
- Vercel Next.js < 14.2.31, 15.0.0 - 15.4.4
Timeline
- 2025-08-29: disclosed
- 2025-08-29: patched: v14.2.31 and v15.4.5